Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
56
0

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
180
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
160
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
100
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
150
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
110
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
93
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
20260326_AIDD事例紹介_ULSC.pdf
Avatar for ファインディ株式会社（イベント資料アップ用） findy_eventslides
0
340
ThetaOS - A Mythical Machine comes Alive
Avatar for Martijn aslander
0
230
SSoT（Single Source of Truth）で「壊して再生」する設計
Avatar for かわうそ kawauso
2
410
JEDAI認定プログラム JEDAI Order 2026 受賞者一覧 / JEDAI Order 2026 Winners
Avatar for Databricks Japan databricksjapan
0
480
契約書からの情報抽出を行うLLMのスループットを、バッチ処理を用いて最大40%改善した話
Avatar for SansanTech sansantech
PRO
3
340
スクラムを支える内部品質の話
Avatar for IIJ_PR iij_pr
0
170
Network Firewall Proxyで 自前プロキシを消し去ることができるのか
Avatar for ぐっさん gusandayo
0
160
The essence of decision-making lies in primary data
Avatar for 株式会社カミナシ kaminashi
0
220
CREがSLOを握ると 何が変わるのか
Avatar for neko maho nekomaho
0
370
「活動」は激変する。「ベース」は変わらない ～ 4つの軸で捉える_AI時代ソフトウェア開発マネジメント
Avatar for 辻裕士/sentokun sentokun
0
140
不確実性と戦いながら見積もりを作成するプロセス/mitsumori-process
Avatar for hiro@miraito hirodragon112
1
170
Move Fast and Break Things: 10 in 20
Avatar for Rami McCarthy ramimac
0
110

Featured

See All Featured
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
Avatar for Stéphanie Walter stephaniewalter
287
14k
Marketing Yourself as an Engineer | Alaka | Gurzu
Avatar for Gurzu gurzu
0
170
YesSQL, Process and Tooling at Scale
Avatar for Rocio Delgado rocio
174
15k
Fashionably flexible responsive web design (full day workshop)
Avatar for Andy Clarke malarkey
408
66k
4 Signs Your Business is Dying
Avatar for Josh Pigford shpigford
187
22k
Bootstrapping a Software Product
Avatar for Garrett Dimon garrettdimon
PRO
307
120k
Lightning Talk: Beautiful Slides for Beginners
Avatar for Ines Montani inesmontani
PRO
1
500
Fireside Chat
Avatar for paigeccino paigeccino
42
3.9k
Paper Plane (Part 1)
Avatar for Katie Cordina Lindsey katiecoart
PRO
0
6.3k
Exploring anti-patterns in Rails
Avatar for Elle Meredith aemeredith
3
300
Optimising Largest Contentful Paint
Avatar for Harry Roberts csswizardry
37
3.6k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
Avatar for Sam Stephenson sstephenson
162
16k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and